Center for Cyber Diplomacy and International Security

By Vladimir Tsakanyan, Ph.D.
Center for Cyber Diplomacy and International Security (CCD-IS)

Post-quantum security is becoming a test of institutional coordination. On November 5, 2026, the Australian Signals Directorate’s Australian Cyber Security Centre announced updated vendor guidance developed with the U.S. Cybersecurity and Infrastructure Security Agency and National Security Agency. The significance lies in its audience: the people who purchase, renew and maintain the technology on which public services and businesses depend. Cryptographic standards can establish a destination; procurement determines whether organisations can reach it.

The official announcement describes a revision with additional background, clearer explanations and broader applicability. It is an update to guidance first announced on July 16, 2026, rather than an entirely new initiative or a November 7 announcement. Its publication does not, by itself, enact a procurement law or impose a universal international deadline.

From standardisation to implementation

The historical foundation predates this week’s announcement. On August 13, 2024, the U.S. National Institute of Standards and Technology finalised its first three post-quantum cryptography standards following years of international evaluation. These included ML-KEM for establishing shared secrets and ML-DSA and SLH-DSA for digital signatures. NIST encouraged organisations to begin the transition. The standards addressed algorithm selection; they did not automatically replace cryptography throughout existing products. [NIST, August 13, 2024]

This distinction matters for policy. A government can specify a security objective while remaining dependent on commercial release schedules, maintenance agreements and technical interfaces. A buyer may control its budget without controlling the cryptographic implementation inside a managed service. Responsibility therefore has to travel across organisational boundaries.

The November guidance supplies questions for procurement, contract renewal and supplier assurance. It organises engagement around finding cryptographic dependencies, assessing risk, prioritising migration, implementing changes and communicating with stakeholders. It also recognises that embedded cryptography and long equipment lifecycles can complicate replacement. These are recommendations for evaluating readiness, rather than proof that any particular vendor is secure.

Cooperation through purchasing decisions

The U.S.–Australian authorship gives an operational task an international dimension. The November 5 announcement explicitly identifies the three participating agencies. It presents vendor engagement as a means of understanding dependencies and supporting informed planning. [ASD’s ACSC, November 5, 2026]

In policy terms, shared questions could make expectations more consistent across markets. Suppliers serving several jurisdictions may find it easier to respond to comparable requests than to incompatible questionnaires. That is an analytical implication of cooperation, not a demonstrated commercial outcome of this release. The guidance establishes neither a mutual-recognition treaty nor a common certification regime.

Its attention to licensing is particularly consequential. The document asks whether post-quantum capability is included in standard licensing and examines how additional charges could impede adoption. It also asks about supported deployment, interoperability and communication of cryptographic changes. [November 2026 guidance, pp. 14–16] Security policy consequently encounters a familiar economic question: whether a technically available safeguard will be accessible to the organisations expected to deploy it.

Evidence should determine confidence

For buyers, the practical policy choice is to seek verifiable commitments proportionate to the importance of the service. A useful assurance process would distinguish a supplier’s ambition from an available product, and an available product from a tested deployment. Treating a roadmap as completed migration would conceal the very dependency procurement is supposed to manage.

The same restraint applies to the underlying threat. Concern about future quantum attacks is not evidence that an adversary has already broken the systems discussed here. NIST’s standards were designed in anticipation of sufficiently capable quantum computers; its 2024 announcement did not establish a certain arrival date. [NIST]

CyberCenter’s earlier analysis of quantum readiness in financial security examined the strategic importance of migration. This update exposes a further implementation problem: national objectives depend on suppliers whose products connect institutions across borders. The measure of success will be whether those dependencies become visible and manageable, and whether purchasing decisions produce security that can be tested in operation.

Cover: AI-generated illustration of fictional technology professionals reviewing network equipment; not a photograph of an actual meeting.